Parse how to bypass chrome xss filter

My previous two popular science: http://www.bkjia.com/Article/201110/109037.html

Http://www.bkjia.com/Article/201110/109036.html,

You should understand the features of chrome xss filter:

 

Based on CSP policy interception, that is, matching the XSS tag and processing the TAG content, that is

<Script> content www.2cto.com </script>

<Script src = content> </script>

Resources such as src have the same-origin policy feature, so we need to combine other WEB vulnerabilities, such as uploading images.

 

The xss filter of chrome11 has an old vulnerability:

Http://seclists.org/fulldisclosure/2011/May/490

What is this old vulnerability:

 

This old vulnerability uses the tag auto-correction feature of chrome xss filter.

Input:

Chrome automatically changes the content:

 

This vulnerability does not exist if the input is output.

Once again, the application and security are a pair of contradictions. The tag correction function for web page compatibility in the application breaks down the XSS Defense Foundation. However, the fun of security workers is not here. Simple vulnerabilities that are straight and white are not fun, and these two vulnerabilities are fun.

 

Finally, from the attacker's point of view, it is concluded that although CSP is a stumbling block, this stumbling block can also be bypassed. However, if we want to make a hard detour, we still need to FUZZ the content in the <> tag, you also need to find out the real benefits for security in applications

From: RAyh4c Black Box